linux-kernel - [PATCH] nfs: lookupcache coherence bugs in WCC update path (revised)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 11 Aug 2010 22:26:36 -0700
From:	"Patrick J. LoPresti" <lopresti@...il.com>
To:	linux-nfs@...r.kernel.org
CC:	linux-kernel@...r.kernel.org
Subject: [PATCH] nfs: lookupcache coherence bugs in WCC update path (revised)

(Well, crud.  I screwed up the previous diff and was missing a
close-curly.  This version actually compiles...)

This patch fixes some coherence bugs in the NFS "dentry lookup cache".

The NFS dentry lookup cache provides the nfs_force_lookup_revalidate()
call to invalidate all cached dentries associated with an inode.  In
general, the NFS client uses the ctime and mtime in the inode to detect
when changes are made on the server.

Therefore, to maintain cache coherence, nfs_force_lookup_revalidate()
must be called whenever the ctime or mtime of a directory inode is
updated with fresh data from the server.  There are a few spots in
nfs_wcc_update_inode() where this rule is violated, making it possible
for the lookup cache to return arbitrarily stale data.

This actually bit me in practice.  I have an application where a
negative dentry results in -ENOENT for a file that was created 30+
minutes earlier (despite the "noac" mount option).  Unfortunately I
cannot share my test case, but I believe the following simple patch is
"obviously correct", and I can confirm that it fixes my issue.

CC: stable <stable@...nel.org>
Signed-off-by: Patrick LoPresti <lopresti@...il.com>

---

--- linux-2.6.35/fs/nfs/inode.c.orig	2010-08-01 15:11:14.000000000 -0700
+++ linux-2.6.35/fs/nfs/inode.c	2010-08-11 22:18:30.000000000 -0700
@@ -819,21 +819,29 @@ static void nfs_wcc_update_inode(struct
 			&& (fattr->valid & NFS_ATTR_FATTR_CHANGE)
 			&& nfsi->change_attr == fattr->pre_change_attr) {
 		nfsi->change_attr = fattr->change_attr;
-		if (S_ISDIR(inode->i_mode))
+		if (S_ISDIR(inode->i_mode)) {
 			nfsi->cache_validity |= NFS_INO_INVALID_DATA;
+			nfs_force_lookup_revalidate(inode);
+		}
 	}
 	/* If we have atomic WCC data, we may update some attributes */
 	if ((fattr->valid & NFS_ATTR_FATTR_PRECTIME)
 			&& (fattr->valid & NFS_ATTR_FATTR_CTIME)
-			&& timespec_equal(&inode->i_ctime, &fattr->pre_ctime))
-			memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime));
+			&& timespec_equal(&inode->i_ctime,
+					  &fattr->pre_ctime)) {
+		if (S_ISDIR(inode->i_mode))
+			nfs_force_lookup_revalidate(inode);
+		memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime));
+	}

 	if ((fattr->valid & NFS_ATTR_FATTR_PREMTIME)
 			&& (fattr->valid & NFS_ATTR_FATTR_MTIME)
 			&& timespec_equal(&inode->i_mtime, &fattr->pre_mtime)) {
 			memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime));
-			if (S_ISDIR(inode->i_mode))
+			if (S_ISDIR(inode->i_mode)) {
 				nfsi->cache_validity |= NFS_INO_INVALID_DATA;
+				nfs_force_lookup_revalidate(inode);
+			}
 	}
 	if ((fattr->valid & NFS_ATTR_FATTR_PRESIZE)
 			&& (fattr->valid & NFS_ATTR_FATTR_SIZE)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/